// ==++== 
//
//   Copyright (c) Microsoft Corporation.  All rights reserved.
//
// ==--== 
/*============================================================
** 
** Class: UnsafeNativeMethods 
**
============================================================*/ 
namespace Microsoft.Win32 {
    using SafeHandles; 
    using System;
    using System.Runtime.ConstrainedExecution;
    using System.Runtime.InteropServices;
    using System.Threading; 
    using System.Runtime.Versioning;
    using System.Security;
    using System.Text;


    //[System.Security.SecuritySafeCritical]
    //internal sealed class EventLogHandle : SafeHandle
    //{
    //    // Called by P/Invoke when returning SafeHandles
    //    private EventLogHandle()
    //        : base(IntPtr.Zero, true)
    //    {
    //    }

    //    internal EventLogHandle(IntPtr handle, bool ownsHandle)
    //        : base(IntPtr.Zero, ownsHandle)
    //    {
    //        SetHandle(handle);
    //    }

    //    public override bool IsInvalid
    //    {
    //        get
    //        {
    //            return IsClosed || handle == IntPtr.Zero;
    //        }
    //    }

    //    protected override bool ReleaseHandle()
    //    {
    //        NativeWrapper.EvtClose(handle);
    //        handle = IntPtr.Zero;
    //        return true;
    //    }

    //    // DONT compare EventLogHandle with EventLogHandle.Zero 
    //    // use IsInvalid instead. Zero is provided where a NULL handle needed
    //    public static EventLogHandle Zero
    //    {
    //        get
    //        {
    //            return new EventLogHandle();
    //        }
    //    }
    //}

    [SuppressUnmanagedCodeSecurityAttribute]
    internal static class UnsafeNativeMethods { 

        internal const String KERNEL32 = "kernel32.dll"; 
        internal const String ADVAPI32 = "advapi32.dll"; 
        internal static readonly IntPtr NULL = IntPtr.Zero;
 
        //
        // Win32 IO
        //
        internal const int ERROR_HANDLE_EOF = 38; 
        internal const int ERROR_INVALID_DRIVE = 0xf;
        internal const int ERROR_NO_MORE_FILES = 0x12; 
        internal const int ERROR_NOT_READY = 0x15; 
        internal const int ERROR_BAD_LENGTH = 0x18;
        internal const int ERROR_SHARING_VIOLATION = 0x20; 
        internal const int ERROR_FILE_EXISTS = 0x50;
        internal const int ERROR_OPERATION_ABORTED = 0x3E3;  // 995; For IO Cancellation
        internal const int ERROR_INVALID_HANDLE = 0x6;
        internal const int ERROR_INVALID_NAME = 0x7B; 
        internal const int ERROR_BAD_PATHNAME = 0xA1;
        internal const int ERROR_ALREADY_EXISTS = 0xB7; 
        internal const int ERROR_ENVVAR_NOT_FOUND = 0xCB; 
        internal const int ERROR_FILENAME_EXCED_RANGE = 0xCE;  // filename too long
        internal const int ERROR_MORE_DATA = 0xEA; 
        internal const int ERROR_NOT_FOUND = 1168;

        internal const int SECURITY_SQOS_PRESENT = 0x00100000;
        internal const int SECURITY_ANONYMOUS = 0 << 16; 
        internal const int SECURITY_IDENTIFICATION = 1 << 16;
        internal const int SECURITY_IMPERSONATION = 2 << 16; 
        internal const int SECURITY_DELEGATION = 3 << 16; 

        internal const int ERROR_BROKEN_PIPE = 109; 
        internal const int ERROR_IO_PENDING = 997;
        internal const int ERROR_PIPE_BUSY = 231;
        internal const int ERROR_NO_DATA = 232;
        internal const int ERROR_PIPE_NOT_CONNECTED = 233; 
        internal const int ERROR_PIPE_CONNECTED = 535;
        internal const int ERROR_PIPE_LISTENING = 536; 
        internal const int ERROR_FILE_NOT_FOUND = 0x2; 
        internal const int ERROR_PATH_NOT_FOUND = 0x3;
        internal const int ERROR_ACCESS_DENIED = 0x5; 
        internal const int ERROR_INVALID_PARAMETER = 0x57;

        internal const int GENERIC_READ = unchecked((int)0x80000000);
        internal const int GENERIC_WRITE = 0x40000000; 

        internal const int STD_INPUT_HANDLE = -10; 
        internal const int STD_OUTPUT_HANDLE = -11; 
        internal const int STD_ERROR_HANDLE = -12;
 
        internal const int DUPLICATE_SAME_ACCESS = 0x00000002;

        internal const int PIPE_ACCESS_INBOUND = 1;
        internal const int PIPE_ACCESS_OUTBOUND = 2; 
        internal const int PIPE_ACCESS_DUPLEX = 3;
        internal const int PIPE_TYPE_BYTE = 0; 
        internal const int PIPE_TYPE_MESSAGE = 4; 
        internal const int PIPE_READMODE_BYTE = 0;
        internal const int PIPE_READMODE_MESSAGE = 2; 
        internal const int PIPE_UNLIMITED_INSTANCES = 255;

        internal const int FILE_FLAG_FIRST_PIPE_INSTANCE = 0x00080000;
        internal const int FILE_SHARE_READ = 0x00000001; 
        internal const int FILE_SHARE_WRITE = 0x00000002;
        internal const int FILE_ATTRIBUTE_NORMAL = 0x00000080; 
 
        internal const int FILE_FLAG_OVERLAPPED = 0x40000000;
 
        internal const int OPEN_EXISTING = 3;
        internal const int ERROR_SUCCESS = 0;

        // From WinBase.h 
        internal const int FILE_TYPE_DISK = 0x0001;
        internal const int FILE_TYPE_CHAR = 0x0002; 
        internal const int FILE_TYPE_PIPE = 0x0003; 

        // 
        // Constants error coded returned by ETW APIs
        //

        // The event size is larger than the allowed maximum (64k - header). 
        internal const int ERROR_ARITHMETIC_OVERFLOW = 534;
 
        // Occurs when filled buffers are trying to flush to disk, 
        // but disk IOs are not happening fast enough.
        // This happens when the disk is slow and event traffic is heavy. 
        // Eventually, there are no more free (empty) buffers and the event is dropped.
        internal const int ERROR_NOT_ENOUGH_MEMORY = 8;

        // Memory mapped file constants 
        internal const int MEM_COMMIT = 0x1000;
        internal const int MEM_RESERVE = 0x2000; 
        internal const int INVALID_FILE_SIZE = -1; 
        internal const int PAGE_READWRITE = 0x04;
        internal const int PAGE_READONLY = 0x02; 
        internal const int PAGE_WRITECOPY = 0x08;
        internal const int PAGE_EXECUTE_READ = 0x20;
        internal const int PAGE_EXECUTE_READWRITE = 0x40;
 
        internal const int FILE_MAP_COPY = 0x0001;
        internal const int FILE_MAP_WRITE = 0x0002; 
        internal const int FILE_MAP_READ = 0x0004; 
        internal const int FILE_MAP_EXECUTE = 0x0020;
 
        [StructLayout(LayoutKind.Sequential)]
        internal class SECURITY_ATTRIBUTES {
            internal int nLength;
            internal unsafe byte* pSecurityDescriptor; 
            internal int bInheritHandle;
        } 
 
        [DllImport(KERNEL32)]
        internal static extern int GetFileType(SafeFileHandle handle); 

        [DllImport(KERNEL32, SetLastError = true)]
        internal static unsafe extern int WriteFile(SafeFileHandle handle, byte* bytes, int numBytesToWrite,
                                                    out int numBytesWritten, NativeOverlapped* lpOverlapped); 

        // Disallow access to all non-file devices from methods that take 
        // a String.  This disallows DOS devices like "con:", "com1:", 
        // "lpt1:", etc.  Use this to avoid security problems, like allowing
        // a web client asking a server for "http://server/com1.aspx" and 
        // then causing a worker process to hang.
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)]
        private static extern SafeFileHandle CreateFile(String lpFileName,
            int dwDesiredAccess, System.IO.FileShare dwShareMode, 
            SECURITY_ATTRIBUTES securityAttrs, System.IO.FileMode dwCreationDisposition,
            int dwFlagsAndAttributes, IntPtr hTemplateFile); 
 
        [ResourceExposure(ResourceScope.Machine)]
        [ResourceConsumption(ResourceScope.Machine)] 
        // <SecurityKernel Critical="True" Ring="0">
        // <CallsSuppressUnmanagedCode Name="CreateFile(String, Int32, FileShare, SECURITY_ATTRIBUTES, FileMode, Int32, IntPtr):SafeFileHandle" />
        // <CallsSuppressUnmanagedCode Name="GetFileType(SafeFileHandle):Int32" />
        // <SatisfiesLinkDemand Name="SafeHandle.get_IsInvalid():System.Boolean" /> 
        // <SatisfiesLinkDemand Name="SafeHandle.Dispose():System.Void" />
        // </SecurityKernel> 
        [SecurityCritical] 
        internal static SafeFileHandle SafeCreateFile(String lpFileName,
                    int dwDesiredAccess, System.IO.FileShare dwShareMode, 
                    SECURITY_ATTRIBUTES securityAttrs, System.IO.FileMode dwCreationDisposition,
                    int dwFlagsAndAttributes, IntPtr hTemplateFile) {
            SafeFileHandle handle = CreateFile(lpFileName, dwDesiredAccess, dwShareMode,
                                securityAttrs, dwCreationDisposition, 
                                dwFlagsAndAttributes, hTemplateFile);
 
            if (!handle.IsInvalid) { 
                int fileType = GetFileType(handle);
                if (fileType != FILE_TYPE_DISK) { 
                    handle.Dispose();
                    throw new NotSupportedException("NotSupported_IONonFileDevices");
                }
            } 
            return handle;
        } 
 

        // From WinBase.h 
        internal const int SEM_FAILCRITICALERRORS = 1;

        [DllImport(KERNEL32, SetLastError = false)]
        [ResourceExposure(ResourceScope.Process)] 
        internal static extern int SetErrorMode(int newMode);
 
        [DllImport(KERNEL32, SetLastError = true, EntryPoint = "SetFilePointer")] 
        [ResourceExposure(ResourceScope.None)]
        private unsafe static extern int SetFilePointerWin32(SafeFileHandle handle, int lo, int* hi, int origin); 

        [ResourceExposure(ResourceScope.None)]
        // <SecurityKernel Critical="True" Ring="0">
        // <CallsSuppressUnmanagedCode Name="SetFilePointerWin32(SafeFileHandle, Int32, Int32*, Int32):Int32" /> 
        // <SatisfiesLinkDemand Name="Marshal.GetLastWin32Error():System.Int32" />
        // </SecurityKernel> 
        [SecurityCritical] 
        internal unsafe static long SetFilePointer(SafeFileHandle handle, long offset, System.IO.SeekOrigin origin, out int hr) {
            hr = 0; 
            int lo = (int)offset;
            int hi = (int)(offset >> 32);
            lo = SetFilePointerWin32(handle, lo, &hi, (int)origin);
 
            if (lo == -1 && ((hr = Marshal.GetLastWin32Error()) != 0))
                return -1; 
            return (long)(((ulong)((uint)hi)) << 32) | ((uint)lo); 
        }
 
        //
        // ErrorCode & format
        //
 
        // Use this to translate error codes like the above into HRESULTs like
 
        // 0x80070006 for ERROR_INVALID_HANDLE 
        internal static int MakeHRFromErrorCode(int errorCode)
        {
            return unchecked(((int)0x80070000) | errorCode);
        }

        // for win32 error message formatting
        private const int FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200; 
        private const int FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000;
        private const int FORMAT_MESSAGE_ARGUMENT_ARRAY = 0x00002000; 
 

        [DllImport(KERNEL32, CharSet = CharSet.Auto, BestFitMapping = false)] 
        internal static extern int FormatMessage(int dwFlags, IntPtr lpSource,
            int dwMessageId, int dwLanguageId, StringBuilder lpBuffer,
            int nSize, IntPtr va_list_arguments);
 
        // Gets an error message for a Win32 error code.
        // <SecurityKernel Critical="True" Ring="0"> 
        // <CallsSuppressUnmanagedCode Name="FormatMessage(Int32, IntPtr, Int32, Int32, StringBuilder, Int32, IntPtr):Int32" /> 
        // </SecurityKernel>
        [SecurityCritical] 
        internal static String GetMessage(int errorCode) {
            StringBuilder sb = new StringBuilder(512);
            int result = FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS |
                FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_ARGUMENT_ARRAY, 
                NULL, errorCode, 0, sb, sb.Capacity, NULL);
            if (result != 0) { 
                // result is the # of characters copied to the StringBuilder on NT, 
                // but on Win9x, it appears to be the number of MBCS buffer.
                // Just give up and return the String as-is... 
                String s = sb.ToString();
                return s;
            }
            return "UnknownError_Num " + errorCode;
        } 

 
        //
        // SafeLibraryHandle
        //
 
        [DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
        [return: MarshalAs(UnmanagedType.Bool)]
        [ResourceExposure(ResourceScope.None)]
        [ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)] 
        internal static extern bool FreeLibrary(IntPtr hModule);
 
 
        //
        // Pipe 
        //

        [DllImport(KERNEL32, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)] 
        internal static extern bool CloseHandle(IntPtr handle);
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        internal static extern IntPtr GetCurrentProcess();
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool DuplicateHandle(IntPtr hSourceProcessHandle,
            SafePipeHandle hSourceHandle, IntPtr hTargetProcessHandle, out SafePipeHandle lpTargetHandle, 
            uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwOptions);
 
        [DllImport(KERNEL32)] 
        internal static extern int GetFileType(SafePipeHandle handle);
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool CreatePipe(out SafePipeHandle hReadPipe,
            out SafePipeHandle hWritePipe, SECURITY_ATTRIBUTES lpPipeAttributes, int nSize); 

 
        [DllImport(KERNEL32, EntryPoint="CreateFile", CharSet = CharSet.Auto, SetLastError = true, BestFitMapping = false)] 
        internal static extern SafePipeHandle CreateNamedPipeClient(String lpFileName,
            int dwDesiredAccess, System.IO.FileShare dwShareMode, 
            SECURITY_ATTRIBUTES securityAttrs, System.IO.FileMode dwCreationDisposition,
            int dwFlagsAndAttributes, IntPtr hTemplateFile);

        [DllImport(KERNEL32, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        unsafe internal static extern bool ConnectNamedPipe(SafePipeHandle handle, NativeOverlapped* overlapped); 
 
        [DllImport(KERNEL32, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)] 
        internal static extern bool ConnectNamedPipe(SafePipeHandle handle, IntPtr overlapped);

        [DllImport(KERNEL32, SetLastError = true, CharSet = CharSet.Auto, BestFitMapping = false)]
        [return: MarshalAs(UnmanagedType.Bool)] 
        public static extern bool WaitNamedPipe(String name, int timeout);
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeHandleState(SafePipeHandle hNamedPipe, out int lpState, 
            IntPtr lpCurInstances, IntPtr lpMaxCollectionCount, IntPtr lpCollectDataTimeout,
            IntPtr lpUserName, int nMaxUserNameSize);

        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeHandleState(SafePipeHandle hNamedPipe, IntPtr lpState, 
            out int lpCurInstances, IntPtr lpMaxCollectionCount, IntPtr lpCollectDataTimeout, 
            IntPtr lpUserName, int nMaxUserNameSize);
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true, BestFitMapping = false)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeHandleState(SafePipeHandle hNamedPipe, IntPtr lpState,
            IntPtr lpCurInstances, IntPtr lpMaxCollectionCount, IntPtr lpCollectDataTimeout, 
            StringBuilder lpUserName, int nMaxUserNameSize);
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeInfo(SafePipeHandle hNamedPipe, 
          out int lpFlags,
          IntPtr lpOutBufferSize,
          IntPtr lpInBufferSize,
          IntPtr lpMaxInstances 
        );
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeInfo(SafePipeHandle hNamedPipe, 
          IntPtr lpFlags,
          out int lpOutBufferSize,
          IntPtr lpInBufferSize,
          IntPtr lpMaxInstances 
        );
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool GetNamedPipeInfo(SafePipeHandle hNamedPipe, 
          IntPtr lpFlags,
          IntPtr lpOutBufferSize,
          out int lpInBufferSize,
          IntPtr lpMaxInstances 
        );
 
        [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static unsafe extern bool SetNamedPipeHandleState( 
          SafePipeHandle hNamedPipe,
          int* lpMode,
          IntPtr lpMaxCollectionCount,
          IntPtr lpCollectDataTimeout 
        );
 
        [DllImport(KERNEL32, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool DisconnectNamedPipe(SafePipeHandle hNamedPipe); 

        [DllImport(KERNEL32, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool FlushFileBuffers(SafePipeHandle hNamedPipe); 

        [DllImport(ADVAPI32, SetLastError = true)] 
        [return: MarshalAs(UnmanagedType.Bool)] 
        [ReliabilityContract(Consistency.WillNotCorruptState, Cer.MayFail)]
        internal static extern bool RevertToSelf(); 

        [DllImport(ADVAPI32, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        [ReliabilityContract(Consistency.WillNotCorruptState, Cer.MayFail)] 
        internal static extern bool ImpersonateNamedPipeClient(SafePipeHandle hNamedPipe);
 
        [DllImport(KERNEL32, SetLastError = true, BestFitMapping = false, CharSet = CharSet.Auto)] 
        internal static extern SafePipeHandle CreateNamedPipe(string pipeName,
            int openMode, int pipeMode, int maxInstances, 
            int outBufferSize, int inBufferSize, int defaultTimeout,
            SECURITY_ATTRIBUTES securityAttributes);

        // Note there are two different ReadFile prototypes - this is to use 
        // the type system to force you to not trip across a "feature" in
        // Win32's async IO support.  You can't do the following three things 
        // simultaneously: overlapped IO, free the memory for the overlapped 
        // struct in a callback (or an EndRead method called by that callback),
        // and pass in an address for the numBytesRead parameter. 
        // <STRIP> See Windows Bug 105512 for details.  -- </STRIP>

        [DllImport(KERNEL32, SetLastError = true)]
        unsafe internal static extern int ReadFile(SafePipeHandle handle, byte* bytes, int numBytesToRead, 
            IntPtr numBytesRead_mustBeZero, NativeOverlapped* overlapped);
 
        [DllImport(KERNEL32, SetLastError = true)] 
        unsafe internal static extern int ReadFile(SafePipeHandle handle, byte* bytes, int numBytesToRead,
            out int numBytesRead, IntPtr mustBeZero); 

        // Note there are two different WriteFile prototypes - this is to use
        // the type system to force you to not trip across a "feature" in
        // Win32's async IO support.  You can't do the following three things 
        // simultaneously: overlapped IO, free the memory for the overlapped
        // struct in a callback (or an EndWrite method called by that callback), 
        // and pass in an address for the numBytesRead parameter. 
        // <STRIP> See Windows Bug 105512 for details.  -- </STRIP>
 
        [DllImport(KERNEL32, SetLastError = true)]
        internal static unsafe extern int WriteFile(SafePipeHandle handle, byte* bytes, int numBytesToWrite,
            IntPtr numBytesWritten_mustBeZero, NativeOverlapped* lpOverlapped);
 
        [DllImport(KERNEL32, SetLastError = true)]
        internal static unsafe extern int WriteFile(SafePipeHandle handle, byte* bytes, int numBytesToWrite, 
            out int numBytesWritten, IntPtr mustBeZero); 

        [DllImport(KERNEL32, SetLastError = true)] 
        internal static extern bool SetEndOfFile(IntPtr hNamedPipe);

        //
        // ETW Methods 
        //
        // 
        // Callback 
        //
        internal unsafe delegate void EtwEnableCallback( 
            [In] ref Guid sourceId,
            [In] int isEnabled,
            [In] byte level,
            [In] long matchAnyKeywords, 
            [In] long matchAllKeywords,
            [In] void* filterData, 
            [In] void* callbackContext 
            );
 
        //
        // Registration APIs
        //
        [DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventRegister", CharSet = CharSet.Unicode)] 
        internal static extern unsafe uint EventRegister(
                    [In] ref Guid providerId, 
                    [In]EtwEnableCallback enableCallback, 
                    [In]void* callbackContext,
                    [In][Out]ref long registrationHandle 
                    );

        [DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventUnregister", CharSet = CharSet.Unicode)]
        internal static extern int EventUnregister([In] long registrationHandle); 

 
        // 
        // Control (Is Enabled) APIs
        // 
        //[DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventEnabled", CharSet = System.Runtime.InteropServices.CharSet.Unicode)]
        //internal static extern int EventEnabled([In] long registrationHandle, [In] ref System.Diagnostics.Eventing.EventDescriptor eventDescriptor);

        [DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventProviderEnabled", CharSet = CharSet.Unicode)] 
        internal static extern int EventProviderEnabled([In] long registrationHandle, [In] byte level, [In] long keywords);
 
        // 
        // Writing (Publishing/Logging) APIs
        // 
        //[DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventWrite", CharSet = System.Runtime.InteropServices.CharSet.Unicode)]
        //internal static extern unsafe uint EventWrite(
        //        [In] long registrationHandle,
        //        [In] ref EventDescriptor eventDescriptor, 
        //        [In] uint userDataCount,
        //        [In] void* userData 
        //        ); 

        //// 
        //// Writing (Publishing/Logging) APIs
        ////
        //[DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventWrite", CharSet = System.Runtime.InteropServices.CharSet.Unicode)]
        //internal static extern unsafe uint EventWrite( 
        //        [In] long registrationHandle,
        //        [In] EventDescriptor* eventDescriptor, 
        //        [In] uint userDataCount, 
        //        [In] void* userData
        //        ); 

        //[DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventWriteTransfer", CharSet = System.Runtime.InteropServices.CharSet.Unicode)]
        //internal static extern unsafe uint EventWriteTransfer(
        //        [In] long registrationHandle, 
        //        [In] ref EventDescriptor eventDescriptor,
        //        [In] Guid* activityId, 
        //        [In] Guid* relatedActivityId, 
        //        [In] uint userDataCount,
        //        [In] void* userData 
        //        );

        [DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventWriteString", CharSet = CharSet.Unicode)]
        internal static extern unsafe uint EventWriteString( 
                [In] long registrationHandle,
                [In] byte level, 
                [In] long keywords, 
                [In] char* message
                ); 
        //
        // ActivityId Control APIs
        //
        [DllImport(ADVAPI32, ExactSpelling = true, EntryPoint = "EventActivityIdControl", CharSet = CharSet.Unicode)] 
        internal static extern /*unsafe (zakomentovane - vlastna uprava)*/ uint EventActivityIdControl([In] int ControlCode, [In][Out] ref Guid ActivityId);
 
        // Native PERFLIB V2 Provider APIs. 
        //
        [StructLayout(LayoutKind.Explicit, Size = 40)] 
        internal struct PerfCounterSetInfoStruct { // PERF_COUNTERSET_INFO structure defined in perflib.h
            [FieldOffset(0)]  internal Guid CounterSetGuid;
            [FieldOffset(16)] internal Guid ProviderGuid;
            [FieldOffset(32)] internal uint NumCounters; 
            [FieldOffset(36)] internal uint InstanceType;
        } 
        [StructLayout(LayoutKind.Explicit, Size = 32)] 
        internal struct PerfCounterInfoStruct { // PERF_COUNTER_INFO structure defined in perflib.h
            [FieldOffset(0)]  internal uint  CounterId; 
            [FieldOffset(4)]  internal uint  CounterType;
            [FieldOffset(8)]  internal Int64 Attrib;
            [FieldOffset(16)] internal uint  Size;
            [FieldOffset(20)] internal uint  DetailLevel; 
            [FieldOffset(24)] internal uint  Scale;
            [FieldOffset(28)] internal uint  Offset; 
        } 
        [StructLayout(LayoutKind.Explicit, Size = 32)]
        internal struct PerfCounterSetInstanceStruct { // PERF_COUNTERSET_INSTANCE structure defined in perflib.h 
            [FieldOffset(0)]  internal Guid CounterSetGuid;
            [FieldOffset(16)] internal uint dwSize;
            [FieldOffset(20)] internal uint InstanceId;
            [FieldOffset(24)] internal uint InstanceNameOffset; 
            [FieldOffset(28)] internal uint InstanceNameSize;
        } 
 
        internal unsafe delegate uint PERFLIBREQUEST(
            [In] uint   RequestCode, 
            [In] void * Buffer,
            [In] uint   BufferSize
        );
 


        // 
        // EventLog
        //
        [Flags]
        internal enum EvtQueryFlags { 
            EvtQueryChannelPath = 0x1,
            EvtQueryFilePath = 0x2, 
            EvtQueryForwardDirection = 0x100, 
            EvtQueryReverseDirection = 0x200,
            EvtQueryTolerateQueryErrors = 0x1000 
        }

        [Flags]
        internal enum EvtSubscribeFlags { 
            EvtSubscribeToFutureEvents = 1,
            EvtSubscribeStartAtOldestRecord = 2, 
            EvtSubscribeStartAfterBookmark = 3, 
            EvtSubscribeTolerateQueryErrors = 0x1000,
            EvtSubscribeStrict = 0x10000 
        }

        internal enum NativeErrorCodes : uint {
            ERROR_SUCCESS = 0, 
            ERROR_INVALID_PARAMETER = 87,
            ERROR_INSUFFICIENT_BUFFER = 122, 
            ERROR_NO_MORE_ITEMS = 259, 
            ERROR_RESOURCE_LANG_NOT_FOUND = 1815,
            ERROR_EVT_MESSAGE_NOT_FOUND = 15027, 
            ERROR_EVT_MESSAGE_ID_NOT_FOUND = 15028,
            ERROR_EVT_UNRESOLVED_VALUE_INSERT = 15029,
            ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND = 15033,
            ERROR_MUI_FILE_NOT_FOUND = 15100 
        }
 
 
        /// <summary>
        /// Evt Variant types 
        /// </summary>
        internal enum EvtVariantType {
            EvtVarTypeNull = 0,
            EvtVarTypeString = 1, 
            EvtVarTypeAnsiString = 2,
            EvtVarTypeSByte = 3, 
            EvtVarTypeByte = 4, 
            EvtVarTypeInt16 = 5,
            EvtVarTypeUInt16 = 6, 
            EvtVarTypeInt32 = 7,
            EvtVarTypeUInt32 = 8,
            EvtVarTypeInt64 = 9,
            EvtVarTypeUInt64 = 10, 
            EvtVarTypeSingle = 11,
            EvtVarTypeDouble = 12, 
            EvtVarTypeBoolean = 13, 
            EvtVarTypeBinary = 14,
            EvtVarTypeGuid = 15, 
            EvtVarTypeSizeT = 16,
            EvtVarTypeFileTime = 17,
            EvtVarTypeSysTime = 18,
            EvtVarTypeSid = 19, 
            EvtVarTypeHexInt32 = 20,
            EvtVarTypeHexInt64 = 21, 
            // these types used internally 
            EvtVarTypeEvtHandle = 32,
            EvtVarTypeEvtXml = 35, 
            //Array = 128
            EvtVarTypeStringArray = 129,
            EvtVarTypeUInt32Array = 136
        } 

        internal enum EvtMasks { 
            EVT_VARIANT_TYPE_MASK = 0x7f, 
            EVT_VARIANT_TYPE_ARRAY = 128
        } 

        [StructLayout(LayoutKind.Explicit, CharSet = CharSet.Auto)]
        internal struct EvtVariant {
            [FieldOffset(0)] 
            public UInt32 UInteger;
            [FieldOffset(0)] 
            public Int32 Integer; 
            [FieldOffset(0)]
            public byte UInt8; 
            [FieldOffset(0)]
            public short Short;
            [FieldOffset(0)]
            public ushort UShort; 
            [FieldOffset(0)]
            public UInt32 Bool; 
            [FieldOffset(0)] 
            public Byte ByteVal;
            [FieldOffset(0)] 
            public byte SByte;
            [FieldOffset(0)]
            public UInt64 ULong;
            [FieldOffset(0)] 
            public Int64 Long;
            [FieldOffset(0)] 
            public Double Double; 
            [FieldOffset(0)]
            public IntPtr StringVal; 
            [FieldOffset(0)]
            public IntPtr AnsiString;
            [FieldOffset(0)]
            public IntPtr SidVal; 
            [FieldOffset(0)]
            public IntPtr Binary; 
            [FieldOffset(0)] 
            public IntPtr Reference;
            [FieldOffset(0)] 
            public IntPtr Handle;
            [FieldOffset(0)]
            public IntPtr GuidReference;
            [FieldOffset(0)] 
            public UInt64 FileTime;
            [FieldOffset(0)] 
            public IntPtr SystemTime; 
            [FieldOffset(8)]
            public UInt32 Count;   // number of elements (not length) in bytes. 
            [FieldOffset(12)]
            public UInt32 Type;
        }
 
        internal enum EvtEventPropertyId {
            EvtEventQueryIDs = 0, 
            EvtEventPath = 1 
        }
 
        /// <summary>
        /// The query flags to get information about query
        /// </summary>
        internal enum EvtQueryPropertyId { 
            EvtQueryNames = 0,   //String;   //Variant will be array of EvtVarTypeString
            EvtQueryStatuses = 1 //UInt32;   //Variant will be Array of EvtVarTypeUInt32 
        } 

        /// <summary> 
        /// Publisher Metadata properties
        /// </summary>
        internal enum EvtPublisherMetadataPropertyId {
            EvtPublisherMetadataPublisherGuid = 0,      // EvtVarTypeGuid 
            EvtPublisherMetadataResourceFilePath = 1,       // EvtVarTypeString
            EvtPublisherMetadataParameterFilePath = 2,      // EvtVarTypeString 
            EvtPublisherMetadataMessageFilePath = 3,        // EvtVarTypeString 
            EvtPublisherMetadataHelpLink = 4,               // EvtVarTypeString
            EvtPublisherMetadataPublisherMessageID = 5,     // EvtVarTypeUInt32 

            EvtPublisherMetadataChannelReferences = 6,      // EvtVarTypeEvtHandle, ObjectArray
            EvtPublisherMetadataChannelReferencePath = 7,   // EvtVarTypeString
            EvtPublisherMetadataChannelReferenceIndex = 8,  // EvtVarTypeUInt32 
            EvtPublisherMetadataChannelReferenceID = 9,     // EvtVarTypeUInt32
            EvtPublisherMetadataChannelReferenceFlags = 10,  // EvtVarTypeUInt32 
            EvtPublisherMetadataChannelReferenceMessageID = 11, // EvtVarTypeUInt32 

            EvtPublisherMetadataLevels = 12,                 // EvtVarTypeEvtHandle, ObjectArray 
            EvtPublisherMetadataLevelName = 13,              // EvtVarTypeString
            EvtPublisherMetadataLevelValue = 14,             // EvtVarTypeUInt32
            EvtPublisherMetadataLevelMessageID = 15,         // EvtVarTypeUInt32
 
            EvtPublisherMetadataTasks = 16,                  // EvtVarTypeEvtHandle, ObjectArray
            EvtPublisherMetadataTaskName = 17,               // EvtVarTypeString 
            EvtPublisherMetadataTaskEventGuid = 18,          // EvtVarTypeGuid 
            EvtPublisherMetadataTaskValue = 19,              // EvtVarTypeUInt32
            EvtPublisherMetadataTaskMessageID = 20,          // EvtVarTypeUInt32 

            EvtPublisherMetadataOpcodes = 21,                // EvtVarTypeEvtHandle, ObjectArray
            EvtPublisherMetadataOpcodeName = 22,             // EvtVarTypeString
            EvtPublisherMetadataOpcodeValue = 23,            // EvtVarTypeUInt32 
            EvtPublisherMetadataOpcodeMessageID = 24,        // EvtVarTypeUInt32
 
            EvtPublisherMetadataKeywords = 25,               // EvtVarTypeEvtHandle, ObjectArray 
            EvtPublisherMetadataKeywordName = 26,            // EvtVarTypeString
            EvtPublisherMetadataKeywordValue = 27,           // EvtVarTypeUInt64 
            EvtPublisherMetadataKeywordMessageID = 28//,       // EvtVarTypeUInt32
            //EvtPublisherMetadataPropertyIdEND
        }
 
        internal enum EvtChannelReferenceFlags {
            EvtChannelReferenceImported = 1 
        } 

        internal enum EvtEventMetadataPropertyId { 
            EventMetadataEventID,       // EvtVarTypeUInt32
            EventMetadataEventVersion,  // EvtVarTypeUInt32
            EventMetadataEventChannel,  // EvtVarTypeUInt32
            EventMetadataEventLevel,    // EvtVarTypeUInt32 
            EventMetadataEventOpcode,   // EvtVarTypeUInt32
            EventMetadataEventTask,     // EvtVarTypeUInt32 
            EventMetadataEventKeyword,  // EvtVarTypeUInt64 
            EventMetadataEventMessageID,// EvtVarTypeUInt32
            EventMetadataEventTemplate // EvtVarTypeString 
            //EvtEventMetadataPropertyIdEND
        }

        //CHANNEL CONFIGURATION 
        internal enum EvtChannelConfigPropertyId {
            EvtChannelConfigEnabled = 0,            // EvtVarTypeBoolean 
            EvtChannelConfigIsolation,              // EvtVarTypeUInt32, EVT_CHANNEL_ISOLATION_TYPE 
            EvtChannelConfigType,                   // EvtVarTypeUInt32, EVT_CHANNEL_TYPE
            EvtChannelConfigOwningPublisher,        // EvtVarTypeString 
            EvtChannelConfigClassicEventlog,        // EvtVarTypeBoolean
            EvtChannelConfigAccess,                 // EvtVarTypeString
            EvtChannelLoggingConfigRetention,       // EvtVarTypeBoolean
            EvtChannelLoggingConfigAutoBackup,      // EvtVarTypeBoolean 
            EvtChannelLoggingConfigMaxSize,         // EvtVarTypeUInt64
            EvtChannelLoggingConfigLogFilePath,     // EvtVarTypeString 
            EvtChannelPublishingConfigLevel,        // EvtVarTypeUInt32 
            EvtChannelPublishingConfigKeywords,     // EvtVarTypeUInt64
            EvtChannelPublishingConfigControlGuid,  // EvtVarTypeGuid 
            EvtChannelPublishingConfigBufferSize,   // EvtVarTypeUInt32
            EvtChannelPublishingConfigMinBuffers,   // EvtVarTypeUInt32
            EvtChannelPublishingConfigMaxBuffers,   // EvtVarTypeUInt32
            EvtChannelPublishingConfigLatency,      // EvtVarTypeUInt32 
            EvtChannelPublishingConfigClockType,    // EvtVarTypeUInt32, EVT_CHANNEL_CLOCK_TYPE
            EvtChannelPublishingConfigSidType,      // EvtVarTypeUInt32, EVT_CHANNEL_SID_TYPE 
            EvtChannelPublisherList,                // EvtVarTypeString | EVT_VARIANT_TYPE_ARRAY 
            EvtChannelConfigPropertyIdEND
        } 

        //LOG INFORMATION
        internal enum EvtLogPropertyId {
            EvtLogCreationTime = 0,             // EvtVarTypeFileTime 
            EvtLogLastAccessTime,               // EvtVarTypeFileTime
            EvtLogLastWriteTime,                // EvtVarTypeFileTime 
            EvtLogFileSize,                     // EvtVarTypeUInt64 
            EvtLogAttributes,                   // EvtVarTypeUInt32
            EvtLogNumberOfLogRecords,           // EvtVarTypeUInt64 
            EvtLogOldestRecordNumber,           // EvtVarTypeUInt64
            EvtLogFull,                         // EvtVarTypeBoolean
        }
 
        internal enum EvtExportLogFlags {
            EvtExportLogChannelPath = 1, 
            EvtExportLogFilePath = 2, 
            EvtExportLogTolerateQueryErrors = 0x1000
        } 

        //RENDERING
        internal enum EvtRenderContextFlags {
            EvtRenderContextValues = 0,      // Render specific properties 
            EvtRenderContextSystem = 1,      // Render all system properties (System)
            EvtRenderContextUser = 2         // Render all user properties (User/EventData) 
        } 

        internal enum EvtRenderFlags { 
            EvtRenderEventValues = 0,       // Variants
            EvtRenderEventXml = 1,          // XML
            EvtRenderBookmark = 2           // Bookmark
        } 

        internal enum EvtFormatMessageFlags { 
            EvtFormatMessageEvent = 1, 
            EvtFormatMessageLevel = 2,
            EvtFormatMessageTask = 3, 
            EvtFormatMessageOpcode = 4,
            EvtFormatMessageKeyword = 5,
            EvtFormatMessageChannel = 6,
            EvtFormatMessageProvider = 7, 
            EvtFormatMessageId = 8,
            EvtFormatMessageXml = 9 
        } 

        internal enum EvtSystemPropertyId { 
            EvtSystemProviderName = 0,          // EvtVarTypeString
            EvtSystemProviderGuid,              // EvtVarTypeGuid
            EvtSystemEventID,                   // EvtVarTypeUInt16
            EvtSystemQualifiers,                // EvtVarTypeUInt16 
            EvtSystemLevel,                     // EvtVarTypeUInt8
            EvtSystemTask,                      // EvtVarTypeUInt16 
            EvtSystemOpcode,                    // EvtVarTypeUInt8 
            EvtSystemKeywords,                  // EvtVarTypeHexInt64
            EvtSystemTimeCreated,               // EvtVarTypeFileTime 
            EvtSystemEventRecordId,             // EvtVarTypeUInt64
            EvtSystemActivityID,                // EvtVarTypeGuid
            EvtSystemRelatedActivityID,         // EvtVarTypeGuid
            EvtSystemProcessID,                 // EvtVarTypeUInt32 
            EvtSystemThreadID,                  // EvtVarTypeUInt32
            EvtSystemChannel,                   // EvtVarTypeString 
            EvtSystemComputer,                  // EvtVarTypeString 
            EvtSystemUserID,                    // EvtVarTypeSid
            EvtSystemVersion,                   // EvtVarTypeUInt8 
            EvtSystemPropertyIdEND
        }

        //SESSION 
        internal enum EvtLoginClass {
            EvtRpcLogin = 1 
        } 



            //SEEK 
            [Flags]
            internal enum EvtSeekFlags { 
                EvtSeekRelativeToFirst = 1, 
                EvtSeekRelativeToLast = 2,
                EvtSeekRelativeToCurrent = 3, 
                EvtSeekRelativeToBookmark = 4,
                EvtSeekOriginMask = 7,
                EvtSeekStrict = 0x10000
            } 

            //[DllImport("wevtapi.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true)] 
            //internal static extern EventLogHandle EvtQuery( 
            //                    EventLogHandle session,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string path, 
            //                    [MarshalAs(UnmanagedType.LPWStr)]string query,
            //                    int flags);

            ////SEEK 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtSeek( 
            //                    EventLogHandle resultSet,
            //                    long position, 
            //                    EventLogHandle bookmark,
            //                    int timeout,
            //                    [MarshalAs(UnmanagedType.I4)]EvtSeekFlags flags
            //                                ); 

            //[DllImport("wevtapi.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true)] 
            //internal static extern EventLogHandle EvtSubscribe( 
            //                    EventLogHandle session,
            //                    SafeWaitHandle signalEvent, 
            //                    [MarshalAs(UnmanagedType.LPWStr)]string path,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string query,
            //                    EventLogHandle bookmark,
            //                    IntPtr context, 
            //                    IntPtr callback,
            //                    int flags); 
 
            //[DllImport("wevtapi.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtNext(
            //                    EventLogHandle queryHandle,
            //                    int eventSize,
            //                    [MarshalAs(UnmanagedType.LPArray)] IntPtr[] events, 
            //                    int timeout,
            //                    int flags, 
            //                    ref int returned); 

            //[DllImport("wevtapi.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtCancel(EventLogHandle handle);

            //[DllImport("wevtapi.dll")] 
            //[ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtClose(IntPtr handle); 

            ///* 
            //[DllImport("wevtapi.dll", EntryPoint = "EvtClose", SetLastError = true)]
            //public static extern bool EvtClose(
            //                    IntPtr eventHandle
            //                                   ); 
            // */
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtGetEventInfo( 
            //                    EventLogHandle eventHandle,
            //    //int propertyId
            //                    [MarshalAs(UnmanagedType.I4)]EvtEventPropertyId propertyId,
            //                    int bufferSize, 
            //                    IntPtr bufferPtr,
            //                    out int bufferUsed 
            //                                    ); 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtGetQueryInfo(
            //                    EventLogHandle queryHandle,
            //                    [MarshalAs(UnmanagedType.I4)]EvtQueryPropertyId propertyId, 
            //                    int bufferSize,
            //                    IntPtr buffer, 
            //                    ref int bufferRequired 
            //                                    );
 
            ////PUBLISHER METADATA
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //internal static extern EventLogHandle EvtOpenPublisherMetadata(
            //                    EventLogHandle session, 
            //                    [MarshalAs(UnmanagedType.LPWStr)] string publisherId,
            //                    [MarshalAs(UnmanagedType.LPWStr)] string logFilePath, 
            //                    int locale, 
            //                    int flags
            //                            ); 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtGetPublisherMetadataProperty( 
            //                    EventLogHandle publisherMetadataHandle,
            //                    [MarshalAs(UnmanagedType.I4)] EvtPublisherMetadataPropertyId propertyId, 
            //                    int flags, 
            //                    int publisherMetadataPropertyBufferSize,
            //                    IntPtr publisherMetadataPropertyBuffer, 
            //                    out int publisherMetadataPropertyBufferUsed
            //                            );

            ////NEW 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtGetObjectArraySize(
            //                    EventLogHandle objectArray, 
            //                    out int objectArraySize
            //                                );

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtGetObjectArrayProperty( 
            //                    EventLogHandle objectArray, 
            //                    int propertyId,
            //                    int arrayIndex, 
            //                    int flags,
            //                    int propertyValueBufferSize,
            //                    IntPtr propertyValueBuffer,
            //                    out int propertyValueBufferUsed 
            //                                    );
 
            ////NEW 2 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //internal static extern EventLogHandle EvtOpenEventMetadataEnum( 
            //                    EventLogHandle publisherMetadata,
            //                    int flags
            //                            );
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            ////public static extern IntPtr EvtNextEventMetadata( 
            //internal static extern EventLogHandle EvtNextEventMetadata( 
            //                    EventLogHandle eventMetadataEnum,
            //                    int flags 
            //                            );

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtGetEventMetadataProperty(
            //                    EventLogHandle eventMetadata, 
            //                    [MarshalAs(UnmanagedType.I4)]  EvtEventMetadataPropertyId propertyId, 
            //                    int flags,
            //                    int eventMetadataPropertyBufferSize, 
            //                    IntPtr eventMetadataPropertyBuffer,
            //                    out int eventMetadataPropertyBufferUsed
            //                           );
 

            ////Channel Configuration Native Api 
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //internal static extern EventLogHandle EvtOpenChannelEnum( 
            //                    EventLogHandle session,
            //                    int flags
            //                            );
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtNextChannelPath( 
            //                    EventLogHandle channelEnum,
            //                    int channelPathBufferSize, 
            //    //StringBuilder channelPathBuffer,
            //                    [Out, MarshalAs(UnmanagedType.LPWStr)]StringBuilder channelPathBuffer,
            //                    out int channelPathBufferUsed
            //                            ); 

 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //internal static extern EventLogHandle EvtOpenPublisherEnum(
            //                    EventLogHandle session, 
            //                    int flags
            //                            );

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtNextPublisherId( 
            //                    EventLogHandle publisherEnum, 
            //                    int publisherIdBufferSize,
            //                    [Out, MarshalAs(UnmanagedType.LPWStr)]StringBuilder publisherIdBuffer, 
            //                    out int publisherIdBufferUsed
            //                            );

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //internal static extern EventLogHandle EvtOpenChannelConfig(
            //                    EventLogHandle session, 
            //                    [MarshalAs(UnmanagedType.LPWStr)]String channelPath, 
            //                    int flags
            //                            ); 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtSaveChannelConfig( 
            //                    EventLogHandle channelConfig,
            //                    int flags 
            //                            ); 

 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtSetChannelConfigProperty(
            //                    EventLogHandle channelConfig, 
            //                    [MarshalAs(UnmanagedType.I4)]EvtChannelConfigPropertyId propertyId,
            //                    int flags, 
            //                    ref EvtVariant propertyValue 
            //                            );
 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtGetChannelConfigProperty( 
            //                    EventLogHandle channelConfig,
            //                    [MarshalAs(UnmanagedType.I4)]EvtChannelConfigPropertyId propertyId, 
            //                    int flags, 
            //                    int propertyValueBufferSize,
            //                    IntPtr propertyValueBuffer, 
            //                    out int propertyValueBufferUsed
            //                           );

            ////Log Information Native Api 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //internal static extern EventLogHandle EvtOpenLog( 
            //                    EventLogHandle session,
            //                    [MarshalAs(UnmanagedType.LPWStr)] string path, 
            //                    [MarshalAs(UnmanagedType.I4)]PathType flags
            //                            );

 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtGetLogInfo( 
            //                    EventLogHandle log,
            //                    [MarshalAs(UnmanagedType.I4)]EvtLogPropertyId propertyId, 
            //                    int propertyValueBufferSize,
            //                    IntPtr propertyValueBuffer,
            //                    out int propertyValueBufferUsed
            //                            ); 

            ////LOG MANIPULATION 
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtExportLog(
            //                    EventLogHandle session,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string channelPath,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string query, 
            //                    [MarshalAs(UnmanagedType.LPWStr)]string targetFilePath,
            //                    int flags 
            //                                ); 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtArchiveExportedLog(
            //                    EventLogHandle session,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string logFilePath, 
            //                    int locale,
            //                    int flags 
            //                                ); 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtClearLog(
            //                    EventLogHandle session,
            //                    [MarshalAs(UnmanagedType.LPWStr)]string channelPath, 
            //                    [MarshalAs(UnmanagedType.LPWStr)]string targetFilePath,
            //                    int flags 
            //                                ); 

            ////RENDERING 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)]
            //internal static extern EventLogHandle EvtCreateRenderContext(
            //                    Int32 valuePathsCount,
            //                    [MarshalAs(UnmanagedType.LPArray,ArraySubType = UnmanagedType.LPWStr)] 
            //                    String[] valuePaths,
            //                    [MarshalAs(UnmanagedType.I4)]EvtRenderContextFlags flags 
            //                            ); 

            //[DllImport("wevtapi.dll", CallingConvention = CallingConvention.Winapi, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtRender(
            //                    EventLogHandle context,
            //                    EventLogHandle eventHandle, 
            //                    EvtRenderFlags flags,
            //                    int buffSize, 
            //                    [Out, MarshalAs(UnmanagedType.LPWStr)]StringBuilder buffer, 
            //                    out int buffUsed,
            //                    out int propCount 
            //                                );


            //[DllImport("wevtapi.dll", EntryPoint = "EvtRender", CallingConvention = CallingConvention.Winapi, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtRender( 
            //                    EventLogHandle context, 
            //                    EventLogHandle eventHandle,
            //                    EvtRenderFlags flags, 
            //                    int buffSize,
            //                    IntPtr buffer,
            //                    out int buffUsed,
            //                    out int propCount 
            //                                );
 
 
            //[StructLayout(LayoutKind.Explicit, CharSet = CharSet.Auto)]
            //internal struct EvtStringVariant { 
            //    [MarshalAs(UnmanagedType.LPWStr),FieldOffset(0)]
            //    public string StringVal;
            //    [FieldOffset(8)]
            //    public UInt32 Count; 
            //    [FieldOffset(12)]
            //    public UInt32 Type; 
            //}; 

            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtFormatMessage(
            //                     EventLogHandle publisherMetadataHandle,
            //                     EventLogHandle eventHandle, 
            //                     uint messageId,
            //                     int valueCount, 
            //                     EvtStringVariant [] values, 
            //                     [MarshalAs(UnmanagedType.I4)]EvtFormatMessageFlags flags,
            //                     int bufferSize, 
            //                     [Out, MarshalAs(UnmanagedType.LPWStr)]StringBuilder buffer,
            //                     out int bufferUsed
            //                                );
 
            //[DllImport("wevtapi.dll", EntryPoint = "EvtFormatMessage", CallingConvention = CallingConvention.Winapi, CharSet = CharSet.Auto, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //internal static extern bool EvtFormatMessageBuffer( 
            //                     EventLogHandle publisherMetadataHandle,
            //                     EventLogHandle eventHandle, 
            //                     uint messageId,
            //                     int valueCount,
            //                     IntPtr values,
            //                     [MarshalAs(UnmanagedType.I4)]EvtFormatMessageFlags flags, 
            //                     int bufferSize,
            //                     IntPtr buffer, 
            //                     out int bufferUsed 
            //                                );
 
 
            ////BOOKMARK
            //[DllImport("wevtapi.dll", EntryPoint = "EvtCreateBookmark", CharSet = CharSet.Auto, SetLastError = true)]
            //internal static extern EventLogHandle EvtCreateBookmark(
            //                    [MarshalAs(UnmanagedType.LPWStr)] string bookmarkXml 
            //                                );
 
            //[DllImport("wevtapi.dll", CharSet = CharSet.Auto, SetLastError = true)] 
            //[return: MarshalAs(UnmanagedType.Bool)]
            //internal static extern bool EvtUpdateBookmark( 
            //                    EventLogHandle bookmark,
            //                    EventLogHandle eventHandle
            //                                );
            // 
            // EventLog
            // 
 
            //
            // Memory Mapped File 
            //
            [StructLayout(LayoutKind.Sequential)]
            internal unsafe struct MEMORY_BASIC_INFORMATION {
                internal void* BaseAddress; 
                internal void* AllocationBase;
                internal uint AllocationProtect; 
                internal UIntPtr RegionSize; 
                internal uint State;
                internal uint Protect; 
                internal uint Type;
            }

            [StructLayout(LayoutKind.Sequential)] 
            internal struct SYSTEM_INFO {
                internal int dwOemId;    // This is a union of a DWORD and a struct containing 2 WORDs. 
                internal int dwPageSize; 
                internal IntPtr lpMinimumApplicationAddress;
                internal IntPtr lpMaximumApplicationAddress; 
                internal IntPtr dwActiveProcessorMask;
                internal int dwNumberOfProcessors;
                internal int dwProcessorType;
                internal int dwAllocationGranularity; 
                internal short wProcessorLevel;
                internal short wProcessorRevision; 
            } 

            [DllImport(KERNEL32, SetLastError = true)] 
            internal static extern void GetSystemInfo(ref SYSTEM_INFO lpSystemInfo);

            [DllImport(KERNEL32, ExactSpelling = true)]
            [return: MarshalAs(UnmanagedType.Bool)] 
            internal static extern bool UnmapViewOfFile(IntPtr lpBaseAddress);
 
            //[DllImport(KERNEL32, SetLastError = true)] 
            //internal static extern int GetFileSize(
            //                    SafeMemoryMappedFileHandle hFile, 
            //                    out int highSize
            //                    );

            //[DllImport(KERNEL32, SetLastError = true)] 
            //unsafe internal static extern IntPtr VirtualQuery(
            //                    SafeMemoryMappedViewHandle address, 
            //                    ref MEMORY_BASIC_INFORMATION buffer, 
            //                    IntPtr sizeOfBuffer
            //                    ); 

            //[DllImport(KERNEL32, SetLastError = true, CharSet = CharSet.Auto, BestFitMapping = false)]
            //internal static extern SafeMemoryMappedFileHandle CreateFileMapping(
            //                    SafeFileHandle hFile, 
            //                    SECURITY_ATTRIBUTES lpAttributes,
            //                    int fProtect, 
            //                    int dwMaximumSizeHigh, 
            //                    int dwMaximumSizeLow,
            //                    String lpName 
            //                    );

            //[DllImport(KERNEL32, ExactSpelling = true, SetLastError = true)]
            //[return: MarshalAs(UnmanagedType.Bool)] 
            //unsafe internal static extern bool FlushViewOfFile(
            //                    byte* lpBaseAddress, 
            //                    IntPtr dwNumberOfBytesToFlush 
            //                    );
 
            //[DllImport(KERNEL32, SetLastError = true, CharSet = CharSet.Auto, BestFitMapping = false)]
            //internal static extern SafeMemoryMappedFileHandle OpenFileMapping(
            //                    int dwDesiredAccess,
            //                    [MarshalAs(UnmanagedType.Bool)] 
            //                    bool bInheritHandle,
            //                    string lpName 
            //                    ); 

            //[DllImport(KERNEL32, SetLastError = true, ExactSpelling = true)] 
            //internal static extern SafeMemoryMappedViewHandle MapViewOfFile(
            //                    SafeMemoryMappedFileHandle handle,
            //                    int dwDesiredAccess,
            //                    uint dwFileOffsetHigh, 
            //                    uint dwFileOffsetLow,
            //                    UIntPtr dwNumberOfBytesToMap 
            //                    ); 

            //[DllImport(KERNEL32, SetLastError = true)] 
            //unsafe internal static extern IntPtr VirtualAlloc(
            //                    SafeMemoryMappedViewHandle address,
            //                    UIntPtr numBytes,
            //                    int commitOrReserve, 
            //                    int pageProtectionMode
            //                    ); 
 
            [DllImport(KERNEL32, CharSet = CharSet.Auto, SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)] 
            internal static extern bool GlobalMemoryStatusEx([In, Out] MEMORYSTATUSEX lpBuffer);

            [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
            internal class MEMORYSTATUSEX { 

                // <SecurityKernel Critical="True" Ring="0"> 
                // <SatisfiesLinkDemand Name="Marshal.SizeOf(System.Type):System.Int32" /> 
                // </SecurityKernel>
                [SecurityCritical] 
                internal MEMORYSTATUSEX() {
                    dwLength = (uint)Marshal.SizeOf(typeof(MEMORYSTATUSEX));
                }
 
                internal uint dwLength;
                internal uint dwMemoryLoad; 
                internal ulong ullTotalPhys; 
                internal ulong ullAvailPhys;
                internal ulong ullTotalPageFile; 
                internal ulong ullAvailPageFile;
                internal ulong ullTotalVirtual;
                internal ulong ullAvailVirtual;
                internal ulong ullAvailExtendedVirtual; 
            }
    } 
} 

// File provided for Reference Use Only by Microsoft Corporation (c) 2007.
